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Abstract 



If two classical provers share an entangled state, the resulting interactive proof system is 
significantly weakened 0. We show that for the case where the verifier computes the XOR of 
two binary answers, the resulting proof system is in fact no more powerful than a system based 
(S| ' on a single quantum prover: ®MIP*[2] C QIP(2). This also implies that ©MIP*[2] C EXP 

, which was previously shown using a different method [7|. This contrasts with an interactive 

proof system where the two provers do not share entanglement. In that case, ©MIP[2] = NEXP 
for certain soundness and completeness parameters [H]. 

OO 

o 
in 

1 Introduction 

Interactive proof systems have received considerable attention j^l |31 |IJ |S1 1141 HUj since their in- 
troduction by Babai 1 and Goldwasser, Micali and Rackoff in 1985. An interactive proof 
system takes the form of a protocol of one or more rounds between two parties, a verifier and a 
prover. Whereas the prover is computationally unbounded, the verifier is limited to probabilistic 
polynomial time. Both the prover and the verifier have access to a common input string x. The 
goal of the prover is to convince the verifier that x belongs to a pre-specified language L. The 
verifier's aim, on the other hand, is to determine whether the prover's claim is indeed valid. In each 
round, the verifier sends a polynomial (in x) size query to the prover, who returns a polynomial 
size answer. At the end of the protocol, the verifier decides to accept, and conclude x G L, or reject 
based on the messages exchanged and his own private randomness. A language has an interactive 
proof if there exists a verifier V and a prover P such that: If x G L, the prover can always convince 
V to accept. If x ^ L, no strategy of the prover can convince V to accept with non-negligible 
probability. IP denotes the class of languages having an interactive proof system. Watrous [HO] 
first considered the notion of quantum interactive proof systems. Here, the prover has unbounded 
quantum computational power whereas the verifier is restricted to quantum polynomial time. In 
addition, the two parties can now exchange quantum messages. QIP is the class of languages having 
a quantum interactive proof system. Classically, it is known that IP = PSPACE [221 For the 
quantum case, it has been shown that PSPACE C QIP C EXP jo()|H2j. If, in addition, the verifier 
is given polynomial size quantum advice, the resulting class QlP/qpoly contains all languages |21j . 
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Let QlP(fc) denote the class where the prover and verifier are restricted to exchanging k messages. 
It is known that QIP = QIP(3) |I2] and QIP(l) C PP [23 US] ■ We refer to US] for an overview of 
the extensive work done on QIP(l), also known as QMA. Very little is known about QIP(2) and 
its relation to either PP or PSPACE. 

In multiple-prover interactive proof systems the verifier can interact with multiple, computa- 
tionally unbounded provers. Before the protocol starts, the provers are allowed to agree on a joint 
strategy, however they can no longer communicate during the execution of the protocol. Let MIP 
denote the class of languages having a multiple-prover interactive proof system. In this paper, we are 
especially interested in two-prover interactive proof systems as introduced by Ben-Or, Goldwasser, 
Kilian and Widgerson [2] . Feige and Lovasz ^0] have shown that a language is in NEXP if and only 
if it has a two-prover one-round proof system, i.e. MIP [2] = MIP = NEXP. Let ©MIP[2] denote the 
restricted class where the verifier's output is a function of the XOR of two binary answers. Even for 
such a system ©MIP [2] = NEXP, for certain soundness and completeness parameters (Hj. Classical 
multiple-prover interactive proof systems are thus more powerful than classical proof systems based 
on a single prover, assuming PSPACE ^ NEXP. Kobayashi and Matsumoto have considered quan- 
tum multiple-prover interactive proof systems which form an extension of quantum single prover 
interactive proof systems as described above. Let QMIP denote the resulting class. In particular, 
they showed that QMIP = NEXP if the provers do not share quantum entanglement. If the provers 
share at most polynomially many entangled qubits the resulting class is contained in NEXP |13j . 

Cleve, H0yer, Toner and Watrous [H] have raised the question whether a classical two-prover 
system is weakened when the provers are allowed to share arbitrary entangled states as part of their 
strategy, but all communication remains classical. We write MIP* if the provers share entanglement. 
The authors provide a number of examples which demonstrate that the soundness condition of a 
classical proof system can be compromised, i.e. the interactive proof system is weakened, when 
entanglement is used. In their paper, it is proved that ©MIP* [2] C NEXP. Later, the same authors 
also showed that ©MIP* [2] C EXP using semidefinite programming 0. Entanglement thus clearly 
weakens an interactive proof system, assuming EXP ^ NEXP. 

Intuitively, entanglement allows the provers to coordinate their answers, even though they 
cannot use it to communicate. By measuring the shared entangled state the provers can gen- 
erate correlations which they can use to deceive the verifier. Tsirelson |26| I24j has shown that 
even quantum mechanics limits the strength of such correlations. Consequently, Popescu and 
Roehrlich |17[ I18[ I19j have raised the question why nature imposes such limits. To this end, they 
constructed a toy-theory based on non-local boxes |17| I27j. which are hypothetical "machines" gen- 
erating correlations stronger than possible in nature. In their full generalization, non-local boxes 
can give rise to any type of correlation as long as they cannot be used to signal, van Dam has 
shown that sharing certain non-local boxes allows two remote parties to perform any distributed 
computation using only a single bit of communication |27[ I28j . Preda [20] showed that sharing 
non-local boxes can then allow two provers to coordinate their answers perfectly and obtained 
©MIP NL = PSPACE, where we write ©MIP NL to indicate that the two provers share non-local 
boxes. 

Kitaev and Watrous ^2] mention that it is unlikely that a single-prover quantum interactive 
proof system can simulate multiple classical provers, because then from QIP C EXP and MIP = 
NEXP it follows that EXP = NEXP. 
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1.1 Our Contribution 

Surprisingly, it turns out that when the provers are allowed to share entanglement it can be possible 
to simulate two such classical provers by one quantum prover. This indicates that entanglement 
among provers truly leads to a weaker proof system. In particular, we show that a two-prover one- 
round interactive proof system where the verifier computes the XOR of two binary answers and 
the provers are allowed to share an arbitrary entangled state can be simulated by a single quantum 
interactive proof system with two messages: ©MIP*[2] C QIP(2). Since very little is known about 
QIP(2) so far ^2]) we hope that our result may help to shed some light about its relation to PP or 
PSPACE in the future. Our result also leads to a proof that ©MIP*[2] C EXP. 

2 Preliminaries 

2.1 Quantum Computing 

We assume general familiarity with the quantum model [16] . In the following, we will use V,V 
and A4 to denote the Hilbert spaces of the verifier, the quantum prover and the message space 
respectively. denotes the real part of a complex number z. 

2.2 Non-local Games 

For our proof it is necessary to introduce the notion of (non-local) games: Let S, T, A and B be 
finite sets, and n a probability distribution on S x T. Let V be a predicate on SxTxAxB. Then 
G = G(V, 7r) is the following two-person cooperative game: A pair of questions (s, t) G S x T is 
chosen at random according to the probability distribution tt. Then s is sent to player 1, henceforth 
called Alice, and t to player 2, which we will call Bob. Upon receiving s, Alice has to reply with 
an answer a G A. Likewise, Bob has to reply to question t with an answer b G B. They win if 
V(s,t,a,b) = 1 and lose otherwise. Alice and Bob may agree on any kind of strategy beforehand, 
but they are no longer allowed to communicate once they have received questions s and t. The 
value oo{G) of a game G is the maximum probability that Alice and Bob win the game. We will 
follow the approach of Cleve et al. jH] and write V(a, b\s, t) instead of V(s, t, a, b) to emphasize the 
fact that a and b are answers given questions s and t. 

Here, we will be particularly interested in non-local games. Alice and Bob are allowed to share 
an arbitrary entangled state |^) to help them win the game. Let A and B denote the Hilbert spaces 
of Alice and Bob respectively. The state |\&) G A <S> B is part of the quantum strategy that Alice 
and Bob can agree on beforehand. This means that for each game, Alice and Bob can choose a 
specific \^>) to maximize their chance of success. In addition, Alice and Bob can agree on quantum 
measurements. For each s G S, Alice has a projective measurement described by {J° : a G A} 
on A. For each t G T, Bob has a projective measurement described by {Y^ : b G B} on B. For 
questions (s,t) G S x T, Alice performs the measurement corresponding to s on her part of \fy) 
which gives her outcome a. Likewise, Bob performs the measurement corresponding to t on his 
part of |^} with outcome b. Both send their outcome, a and b, back to the verifier. The probability 
that Alice and Bob answer (a, b) G A x B is then given by 

(^|x s a ®y t b |*). 
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The probability that Alice and Bob win the game is given by 

Pr[Alice and Bob win] = ^ vr(s, t) ^ V(o, b\s, t)(^\X* ® Y t b \t>). 

s,t a,b 

The quantum value UJq(G) of a game G is the maximum probability over all possible quantum 
strategies that Alice and Bob win. An XOR game is a game where the value of V only depends 
on c = a © b and not on a and & independently. For XOR games we write V(c\s,t) instead of 
V(a, b\s, t). We will use t{G) to denote the value of the trivial strategy where Alice and Bob ignore 
their inputs and return random answers a £r {0, 1}, b £r {0, 1} instead. For an XOR game, 

r(G)= 1 -^(s,t) £ V(c\s,t). (1) 
*,t ce{o,i} 

In this paper, we will only be interested in the case that a £ {0, 1} and b £ {0, 1}. Alice and 
Bob's measurements are then described by {X®,X].} for s £ S and {Y®, Y^} for t £ T respectively. 
Note that X® + X^ = I and Y® + = / and thus these measurements can be expressed in 
the form of observables X s and Yt with eigenvalues ±1: X s = X® — X\ and Yt = Y® — Y^. 
Tsirelson |261 I24| has shown that for any |^} £ A ® B there exists real vectors x s ,yt £ M. N with 
N = min(|5|, \T\) such that (9\X 9 © Y t \V) = (x s \y t ). Conversely, if dim(A) = dim(B) = 2™ 
and |^) £ A® B is & maximally entangled state, there exist observables X s on A, Yt on B such 
that (x s \yt) = (&\X S ® ^t|^)- See (2^1 Theorem 3.5] for a detailed construction. 

2.3 Interactive Proof Systems 
2.3.1 Multiple Provers 

It is well known jSJ EI] > that two-prover one-round interactive proof systems with classical com- 
munication can be modeled as (non-local) games. Here, Alice and Bob take the role of the two 
provers. The verifier now poses questions s and t, and evaluates the resulting answers. A proof 
system associates with each string x a game G x , where u„(G x ) determines the probability that the 
verifier accepts (and thus concludes x £ L). The string x, and thus the nature of the game G x is 
known to both the verifier and the provers. Ideally, for all x £ L the value of uj q {G x ) is close to 
one, and for x ^ L the value of u q (G x ) is close to zero. It is possible to extend the game model 
for MIP[2] to use a randomized predicate for the acceptance predicate V. This corresponds to V 
taking an extra input string chosen at random by the verifier. However, known applications of 
MIP[2] proof systems do not require this extension Our argument in Section |21 can easily be 
extended to deal with randomized predicates. Since V is not a randomized predicate in we here 
follow this approach. 

In this paper, we concentrate on proof systems involving two provers, one round of communica- 
tion, and single bit answers. The provers are computationally unbounded, but limited by the laws 
of quantum physics. However, the verifier is probabilistic polynomial time bounded. As defined by 
Cleve et al. UJ, 

Definition 1 For < s < c < 1, let ©MIP CjS [2] denote the class of all languages L recognized by 
a classical two-prover interactive proof system of the following form: 

• They operate in one round, each prover sends a single bit in response to the verifier's question, 
and the verifier's decision is a function of the parity of those two bits. 
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• If x ^ L then, whatever strategy the two provers follow, the probability that the verifier accepts 
is at most s (the soundness probability). 

• If x £ L then there exists a strategy for the provers for which the probability that the verifier 
accepts is at least c (the completeness probability). 

Definition 2 For < s < c < 1, let ©MIP* S [2] denote the class corresponding to a modified 
version of the previous definition: all communication remains classical, but the provers may share 
prior quantum entanglement, which may depend on x, and perform quantum measurements. 

2.3.2 A Single Quantum Prover 

Instead of two classical provers, we now consider a system consisting of a single quantum prover 
P q and a quantum polynomial time verifier V q as denned by Watrous [HOI- Again, the quantum 
prover P q is computationally unbounded, however, he is limited by the laws of quantum physics. 
The verifier and the prover can communicate over a quantum channel. In this paper, we are only 
interested in one round quantum interactive proof systems: the verifier sends a single quantum 
message to the prover, who responds with a quantum answer. We here express the definition of 
QIP(2) [HOI in a form similar to the definition of ©MIP*: 

Definition 3 Let QIP(2,c, s) denote the class of all languages L recognized by a quantum one- 
prover one-round interactive proof system of the following form: 

• If x ^ L then, whatever strategy the quantum prover follows, the probability that the quantum 
verifier accepts is at most s. 

• If x £ L then there exists a strategy for the quantum prover for which the probability that the 
verifier accepts is at least c. 

3 Main Result 

We now show that an interactive proof system where the verifier is restricted to computing the 
XOR of two binary answers is in fact no more powerful than a system based on a single quantum 
prover. The main idea behind our proof is to combine two classical queries into one quantum query, 
and thereby simulate the classical proof system with a single quantum prover. Recall that the two 
provers can use an arbitrary entangled state as part of their strategy. For our proof we will make 
use of the following proposition shown in [f)J Proposition 5.7]: 

Proposition 1 (CHTW) Let G(V, ir) be an XOR game and let 
N = min(\S\,\T\). Then 

w q {G)-T{G) =Jma X Vi( S ,t) (V(0\s,t) - V(l\s,t)) (x s \y t ), 

s,t 

where the maximization is taken over unit vectors 

{x s eR N :se S}U{y t £R N :t£ T}. 
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Theorem 1 For all s and c such that < s < c < 1, ©MIP* a [2] C QIP(2, c,s) 



Proof. Let L G ©MIP* s [2] and let V e be a verifier witnessing this fact. Let P} (Alice) and P e 2 
(Bob) denote the two provers sharing entanglement. Fix an input string x. As mentioned above, 
interactive proof systems can be modeled as games indexed by the string x. It is therefore sufficient 
to show that there exists a verifier V q and a quantum prover P q , such that w s i m (G x ) = w q (G x ), 
where w s i m (G x ) is the value of the simulated game. 

Let s,t be the questions that V e sends to the two provers Pj and P% in the original game. The 
new verifier V q now constructs the following state in V © M 

V M V M 

and sends register A4 to the single quantum prover P q l 

We first consider the honest strategy of the prover. Let a and b denote the answers of the two 
classical provers to questions s and t respectively. The quantum prover now transforms the state 
to 

leanest) = ^= ((-1)° J^^ + t" 1 ) 6 J^^)> 

V M V M 

and returns register M back to the verifier. The verifier V q now performs a measurement on V<8> M 
described by the following projectors 

p = \K)(*ft\®i 

P 1 = |*-)<vlr-|®/ 
Preject = I Po ~ Pi j 

where |*^) = (|0)|0)|s) ± |l)|l)|t))/\/2. If he obtains outcome "reject", he immediately aborts 
and concludes that the quantum prover is cheating. If he obtains outcome m G {0, 1}, the verifier 
concludes that c = a © b = m. Note that Pr[m = a © b\s,t] = {^honest\Pa®b\^ honest) = 1> so the 
verifier can reconstruct the answer perfectly. 

We now consider the case of a dishonest prover. In order to convince the verifier, the prover 
applies a transformation on A4 <8> V and send register M. back to the verifier. We show that for any 
such transformation the value of the resulting game is at most w q (G x ): Note that the state of the 
total system in V © M, © V can now be described as 

|$ d ^) = i=(|O)|^) + |l)|0 t )) 

where \<f> 8 ) = J^ueS'uT' l n )l Q «) and 1^) = Y, v eS'uT' \ v )\ a l) witn = {0s|s G S} and T = {lt\t G 
T}. Any transformation employed by the prover can be described this way. We now have that 

Pr[m = 0M = (^|Po|^) = ^((a:i^) + (^|a*)) + ^((^|a*)) (2) 
Pr[m = lM = ($ dish \Pi\$ dish ) = ^((at\al) + (aM)) - ^((allaf)) (3) 



x If questions s and t are always orthogonal, it suffices to use ^=(|0)|s) + 
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The probability that the prover wins is given by 



Pr[Prover wins] = ^^7r(s,i) V(c\s,t)Pr[m = c\s,t]. 

s,t ce{o,i} 

The prover will try to maximize his chance of success by maximizing Pr[m = 0\s, t] or Pr[m = l\s, t]. 
We can therefore restrict ourselves to considering real unit vectors for which (a s s \a s s ) = 1 and 
(o4|c4) = 1. This also means that } = iff s ^ s' and \a\ } = iff t 7^ t' . Any other strategy can 
lead to rejection and thus to a lower probability of success. By substituting into Equations |2 and 01 
it follows that the probability that the quantum prover wins the game when he avoids rejection is 
then 

i^7r(s,t)y(c| S ,t)(l + (-l) c K|a*)). (4) 

s,t,c 

In order to convince the verifier, the prover 's goal is to choose real vectors |a|) and |a*} which 
maximize Equation^] Since in \4> s ) and \(j>t) we sum over |S"| + |T"| = |,S| + |T| elements respectively, 
the dimension of V need not exceed \S\ + \ T\. Thus, it is sufficient to restrict the maximization to 
vectors in R^W^L In fact, since we are interested in maximizing the inner product of two vectors 
from the sets {a* : s G S} and {a\ : t G T}, it is sufficient to limit the maximization of vectors to 
M. N with N = minds'!, |T|) [H]: Consider the projection of the vectors {a* : s G S} onto the span 
of the vectors {a\ : t £ T} (or vice versa). Given Equation |1J we thus have 

w s im(G x ) = max ^ V vr(s, t)V{c\s, i)(l + (-l) c (a^|a^)), 
a%,a\ 2,^ 

s 1 s,t,c 

where the maximization is taken over vectors {a s s G 1^ : s G 5}, and {a\ G M. N : t G T}. However, 
Proposition ^ an d Equation ^ imply that 



(G x ) = max J y^ir(s,t)V(c\s,t)(l + (-iy( Xs \y t )) 



s,t,c 



where the maximization is taken over unit vectors {x s G : s G S} and {y t G R N : t G T}. We 
thus have 

(Gx) = W q (G x ) 

which completes our proof. □ 
Corollary 1 For all s and c such that < s < c < 1, ©MIP* S [2] C EXP 

Proof. This follows directly from Theorem Hand the result that QIP(2) C EXP Q2|. □ 



4 Discussion 

It would be interesting to show that this result also holds for a proof system where the verifier is 
not restricted to computing the XOR of both answers, but some other boolean function. However, 
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it remains unclear what the exact value of a binary game would be. The approach based on vectors 
from Tsirelson's results does not work for binary games. Whereas it is easy to construct a single 
quantum query which allows the verifier to compute an arbitrary function of the two binary answers 
with some advantage, it thus remains unclear how the value of the resulting game is related to the 
value of a binary game. Furthermore, mere classical tricks trying to obtain the value of a binary 
function from XOR itself seem to confer extra cheating power to the provers. 

Examples of non-local games with longer answers , such as the Kochen-Specker or the Magic 
Square game, seem to make it even easier for the provers to cheat by taking advantage of their 
entangled state. Furthermore, existing proofs that MIP = NEXP break down if the provers share 
entanglement. It is therefore an open question whether MIP* = NEXP or, what may be a more 
likely outcome, MIP* C EXP. 

Non-locality experiments between two spacelike separated observers, Alice and Bob, can be cast 
in the form of non-local games. For example, the experiment based on the well known CHSH in- 
equality [3] , is a non-local game with binary answers of which the verifier computes the XOR jS] • Our 
result implies that this non-local game can be simulated in superposition by a single prover /observer: 
Any strategy that Alice and Bob might employ in the non-local game can be mirrored by the single 
prover in the constructed "superposition game", and also vice versa, due to Tsirelson's construc- 
tions |26l I24| mentioned earlier. This means that the "superposition game" corresponding to the 
non-local CHSH game is in fact limited by Tsirelson's inequality [22j, even though it itself has 
no non-local character. Whereas this may be purely coincidental, it would be interesting to know 
its physical interpretation, if any. Perhaps it may be interesting to ask whether Tsirelson type 
inequalities have any consequences on local computations in general, beyond the scope of these 
very limited games. 
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